Loading threat actor…
UNC5976 is a suspected Russian state-linked espionage cluster focused on Ukraine-related defense targeting. It has been associated with phishing operations against Ukrainian and allied defense assets and is assessed to support Russian intelligence objectives connected to the war in Ukraine. Reported targeting includes Ukrainian defense, military, government, and energy organizations, with broader Russian cluster activity centered on battlefield technology, secure communications, and direct attacks on Ukrainian and allied defense-related entities. UNC5976 is known for phishing campaigns that deliver malicious Remote Desktop Protocol connection files using drone-themed and defense-themed social-engineering lures. The operation has used spoofing of trusted telecommunications or defense-related brands to increase plausibility and induce victim interaction. This tradecraft aligns with broader Russian efforts to gain access to organizations involved in battlefield operations, military communications, and defense support functions. The cluster’s observed capabilities center on initial access through phishing, reconnaissance and targeting of defense-sector victims, and defense-evasion through deceptive lures and impersonation. UNC5976 has been described as part of a wider set of Russian clusters that prioritize battlefield-relevant intelligence collection and attacks on Ukrainian and allied defense ecosystems.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian cluster described as focusing on battlefield technology, secure communications, and attacks on Ukrainian and allied defense assets.
Phishing operations using malicious RDP files and drone-themed decoys impersonating defense firms (likely credential access/initial access for espionage).
Russian espionage activity using phishing to deliver weaponized RDP configuration files that beacon to attacker-controlled, telecom-lookalike infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.